Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-6836

Good to know:

icon
icon

Date: December 15, 2023

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.

Language: Java

Severity Score

Related Resources (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-6836
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-0716/
https://www.mend.io/vulnerability-database/CVE-2023-6836

Severity Score

Weakness Type (CWE)

Improper Restriction of XML External Entity Reference ('XXE')

CWE-611

Top Fix

icon

Upgrade Version

Upgrade to version org.wso2.carbon.registry:org.wso2.carbon.registry.extensions:4.7.31, org.wso2.carbon.event-processing:org.wso2.carbon.event.processor.core:2.2.12, org.wso2.carbon.analytics-common:org.wso2.carbon.event.template.manager.core:5.2.23, org.wso2.carbon.analytics-common:org.wso2.carbon.event.input.adapter.core:5.2.23, org.wso2.carbon.governance:org.wso2.carbon.governance.common:4.8.13

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us